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A scheme is proposed by which two parties, Alice and Bob, can securely exchange real numbers. 
The scheme requires Alice and Bob to share entanglement and both to perform Bell-state measure- 
ments. With a qubit system two real numbers can each be sent by Alice and Bob, resulting in 
four real numbers shared by them. The number of real numbers that can be shared increases if 
higher-dimensional systems are utilized. The number of significant figures of each shared real num- 
ber depends upon the number of Bell-state measurements that Alice and Bob perform. The security 
of the scheme against individual eavesdropping attacks is analyzed and the effects of channel losses 
and errors discussed. 



Since the introduction by Bennett and Brassard in 
1984 of the first complete protocol(BB84) for quantum 
key distribution 1], many proposals for its variations, im- 
provements and modifications have appeared and their 
experimental implementations have been developed^- 
The security of the BB84 protocol and its variations 
rely upon the quantum-mechanical principle that infor- 
mation gain in an attempt to distinguish between two 
non-orthogonal quantum states introduces a detectable 
disturbance in the state of the system. The sender, Al- 
ice, sends the signal to the receiver, Bob, in states chosen 
randomly from two conjugate bases. The eavesdropper, 
Eve, cannot guess the basis right every time, and her at- 
tempt to measure the signal in the wrong basis inevitably 
introduces an error to the key transmission. 

An interesting alternative to the BB84 protocol is the 
scheme based on entangled pairs first proposed by Ek- 
ert in 1991 (E91) 3j. In its original version with spin 
(polarization)-entangled particles, Alice and Bob per- 
form spin measurements along one of three directions. 
The measurement direction is chosen randomly and in- 
dependently of each other. Measurement outcomes ob- 
tained when they measure along the same direction can 
be used for key generation, while those obtained when 
they measure along different directions are used to test 
Bell's inequality. The security of the E91 protocol de- 
pends upon the fact that eavesdropping reduces the de- 
gree of correlation between the two members of the en- 
tangled pair and that this reduction manifests itself as a 
reduction in the degree of violation of Bell's inequality. 

In this work we propose a scheme which allows two par- 
ties, Alice and Bob, to simultaneously and securely ex- 
change real numbers. As in the E91 protocol, the scheme 
requires Alice and Bob to share entanglement. Instead 
of performing measurements along randomly chosen di- 
rections, however, Alice and Bob are required to perform 
Bell-state measurements. The security of the scheme re- 
lies upon the fact that eavesdropping changes the out- 
come of the Bell-state measurements. This change in the 
outcome of the Bell-state measurements originates from 
the reduction in the degree of correlation between the two 
members of the entangled pair caused by eavesdropping. 
In this respect, the proposed scheme may be considered 



as a variation of the E91 protocol. The scheme, how- 
ever, involves no random choice of bases or directions. 
With a qubit system, Alice and Bob each can send two 
real numbers to each other, resulting in four real num- 
bers shared by them. The number of significant figures 
of each shared real number is determined by the number 
of Bell-state measurements that Alice and Bob perform. 
The protocol may thus be considered as a scheme to al- 
low Alice and Bob to securely share integers (or collection 
of digits) whose length is determined by the number of 
Bell-state measurements they perform. The digits they 
share can be used for key generation for cryptographic 
purposes. 

Let us suppose that Alice has an EPR(Einstcin- 
Podolsky-Rosen) source that emits a large number 
N(^>1) of entangled pairs one by one at a regular time 
interval, each pair in the same Bell state. The Bell state 
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but for the sake of the concreteness of argument, we take 
it as | $oo) ab- Alice keeps the qubit A of each pair and 
sends the qubit B to Bob. 

Alice has in her possession another set of N qubits, 
which we denote by the subscript a, each of which she 
prepared in the state \tp) a = a\0) a + b\l) a (\a\ 2 + \b\ 2 = 
1). Since Alice prepared the qubits a in this state, she 
and only she knows what a and b are, and she keeps 
them to herself. Alice performs a series of N Bell-state 
measurements on each pair of qubits a and A. On the 
other side, Bob has in his possession yet another set of 
N qubits, which we denote by the subscript /3, each of 
which he prepared in the state \tp)p = x\0)p+y\l)p (\x\ 2 + 
\y\ 2 = 1). Since Bob prepared the qubits in this state, 
he and only he knows what x and y are, and he keeps 
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FIG. 1: Experimental Scheme. The EPR(Einstein-Podolsky- 
Rosen) source emits entangled pairs in state |$oo)ab- Alice 
performs Bell-state measurements on the qubit pairs a and 
A, and Bob on the qubit pairs ft and B. BSM stands for Bell- 
state measurement. 



them to himself. Bob also performs a series of N Bell- 
state measurements on each pair of qubits (3 and B. The 
experimental scheme is depicted schematically in Fig. 1. 

In order to find the probability Pijki that Alice's 
Bell-state measurement yields \&ij) a A and Bob's Bell- 
state measurement yields \^ki)/3B, we expand the total 
wave function \ip) a pAB = a\ip) p\®oo) ab in terms of 



\®ij)aA\®ki)/3B as 



E \^) aA \®M) 0B V ljkl . (2) 



A straight forward algebra yields 



Vbooi = ^oioo = Vion = Vino = 
Kjoio = —Vom = Viooo 
Vbon = — Vbno = Viooi 
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(xa — yb) (3b) 



Vuoi = ^= (xb + ya) (3c) 
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Vnoo = -^j= {xb ~ ya)(3d) 



The probabilities Py/a's are given by P ijk i = \V ljk i\ 2 - 
Alice and Bob can determine these probabilities exper- 
imentally from the result of their Bell-state measure- 
ments. They only need to count the number Nijki of 
occurrences for the joint outcome \&ij) a A\&ki)f3B- The 
experimentally determined probabilities are then given 
by 
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Suppose now, however, that Alice and Bob each an- 
nounce publicly her or his measurement result only when 
the outcome is $10 or $n. This is consistent with the 
realistic situation, because only these two Bell states 
can be unambiguously distinguished with linear optical 
means Q. The probabilities that can be determined ex- 
perimentally are then only P^oio > ^ioTi > ^iuo > an< ^ ^rm ■ 



Vbooo = Vbioi = V1010 = Vim = — 7= i xa + yb) (3a) These probabilities are given theoretically as 

2v 2 



P1010 = -P1111 = 7: \xa + yb\ 2 = i [cos 2 9 a cos 2 9b + sin 2 9 a sin 2 9b + 2 cos 9 a cos 9b sin 9 a sin 9b cos (c/) a + fa)] (5a) 
8 8 
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Pion = Pino = - \xa — yb\ z = - [cos 2 9 a cos 2 9b + sin 2 9 a sin 2 9b — 2 cos 9 a cos 9b sin 9 a sin 9b cos {cj) a + <pb)] (5b) 

I 



where we set 

a = cos9 a , b = sm9 a e 1 ^' 1 
x~ cos 9b, y — sin 9be l ^ b 

When the experimentally determined probabilities are 
substituted for the corresponding theoretical probabili- 
ties, Eqs. (5) constitute two equations that relate the 
four constants 9 a ,4> a , 9b and Since Alice knows 9 a and 
(j> a , she can use the two equations to solve for 9b and </>{,. 
Similarly, Bob knows 9b and and therefor he can use 
the two equations to solve for 9 a and <j> a . A third person, 
an eavesdropper, however, knows none of the four con- 
stants, and there is no way for her to determine the four 
unknown constants from the two equations. Thus, the 
method described above, with Alice and Bob announc- 
ing her or his measurement result only when the outcome 
is t&io or <E>ii , provides a means for Alice and Bob to se- 



curely share four real numbers. Without loss of generality 
we take them as cos 9 a , cos <j> a , cos 9b and cos <fib , four real 
numbers less than 1. 

The number of real numbers that can be shared in- 
creases if Alice and Bob use higher-dimensional systems. 
The generalized Bell states for a d-dimensional system 
qudit) can be defined as [f| 

d-l 

\^ l ) AB = —Y J ^ lq \l)k + 3) (7) 

where uj = e %2 ^~ . As before, we assume that each of the 
entangled pairs AB produced by the source is in | $00} ab ■ 
Alice performs a series of Bell-state measurements on 
each pair of the qudit A and another qudit a she pre- 
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pared in the state a,i\i) a , while Bob performs a series 
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FIG. 2: Eve's intercept-resend attack 



of Bell-state measurements on each pair of the qudit B 

d-l 

and another qudit (3 he prepared in the state ^ Xi\i)p. 

i=0 

As in the qubit case, the total wave function \ip) a 0AB can 
be expanded in terms of the Bell states \&ij) a A\®ki}0B, 
and the probability amplitudes Vijki's can be expressed 
in terms of a^s and x^s. we obtain 

d-l 

V ijkl = —= V U-V+^Orn-j X m - k (8) 

where all indices are evaluated modulo d. The probabil- 
ities Pijki's are then determined by Piju = \Vijki\ 2 - 

The constants a^s and x^s constitute (4d-4) unknowns 
to be determined from experimentally determined prob- 
abilities -Pj^d's. To Alice and Bob, however, there are 
only (2d-2) unknowns. By agreeing to publicly announce 
the measurement result only when the measurement out- 
come is among judiciously chosen Bell states, Alice and 
Bob can limit the number of probabilities that can be de- 
termined experimentally in such a way that the number 
of equations that relate the experimentally determined 
probabilities with the parameters dj's and a^'s is greater 
than or equal to (2d-2) but less than (4d-4). This way, 
(4d-4) real numbers can be secretely shared between Al- 
ice and Bob. 

We now discuss the security of the scheme described 
above against eavesdropping attacks. Perhaps the sim- 
plest attack that Eve can attempt is the intercept-resend 
attack depicted in Figure 2. In this attack Eve intercepts 
each qubit B being transmitted from Alice to Bob and 
keeps it, while she generates her own entangled pairs EF 
in the Bell state |$oo)bf, keeps the qubits E herself and 
sends the other qubits F to Bob. In addition to qubits 
B and E, Eve has two sets of qubits 7 and S, which she 
prepares in states, say, x'|0) 7 + y'|0) 7 and a'\0)s +b'\l)s, 
respectively. Eve performs her own Bell-state measure- 
ments on the pairs 7 and B and separately on the pairs 
5 and E. By looking at correlations of the outcomes of 
her 7-B measurement and Alice's a- A measurement, Eve 
can determine a and b, i.e., cos# a and cos (fi a . Similarly, 
from correlations of the outcomes of her 6-E measure- 
ment and Bob's /3-F measurement, she can determine x 
and y, i.e., cos 9b and cos (fib, too. On the other side, Al- 
ice and Bob would have performed their Bell-state mea- 
surements on the pairs aA and /3-F, respectively. Note, 
however, that the qubits A and F are not entangled, and 




FIG. 3: Eve's entangle-measure attack 

thus Alice's Bell-state measurement is completely inde- 
pendent of Bob's Bell-state measurement. As a result, 
all the probabilities Pijki's should be the same, i.e., 

Pijkl = j^, i,j,k,l = or 1 

Alice and Bob can check if P1010 or Pun is the same 
as (or close to) P1011 or P mo . If they feel that the two 
probabilities are too close to trust, they discard the data 
and restart from the beginning. It is possible that the 
two probabilities are the same (or close) not because of 
Eve's attack but because Alice and Bob happen to choose 
4> a and <fib such that cos((fi a + (fib) ~ 0. This case will also 
have to be discarded. If Eve attacks not all but only a 
part of the qubits B, the two probabilities may not be suf- 
ficiently close to be detected. In this case Alice and Bob 
must resort to digit comparison to detect Eve's attack. 
Due to the attack, the real numbers cos6> a and cos^ a 
(cos 9b and cos (fib) computed by Bob(Alice) from the ex- 
perimentally determined probabilities will deviate from 
the correct values that Alice (Bob) initially assigned. By 
comparing a few digits (e.g., a digit at the third decimal 
point of cosOa) and checking if they agree, Alice and Bob 
can check against Eve's attacks. 

Another possible mode of attack is the "entangle- 
measure" attack depicted in Fig. 3. In this attack Eve 
prepares a set of ancilla qubits E each in state |0)b, 
entangle each of them with the qubit B by perform- 
ing a CNOT operation with the qubit B as the con- 
trol bit and the qubit E as the target bit, and performs 
a Bell-state measurement upon each pair of the qubit 
E and another qubit 77 a set of which she prepares in 
state, say, u\Q) n + v\0) v . In this mode of attack, Eve's 
role is indistinguishable from Bob's role, and she can 
obtain as much information as Bob can. In order to 
find the effect of the entangle-measure attack upon the 
probabilities Pijki's, we expand the six-qubit wave func- 
tion \^) a0v ABE = (a\0) a + b\l) a )(x\O) + y\l)p)(u\0) n + 
v\1)v)^(\Q)a |0> b \0) e + \l) A \1) B \1) E ) in terms of the 
product of the Bell states as 

1 

Wlcc^ABE = ^2 \^) a A l $ «)/3S \®mn) v E Vijklmn 

i,j,k,l,m,n=0 

(9) 

and calculate the probabilities according to Pijkl — 
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^2 \Vijkimn\ ■ A straightforward algebra yields 

m,n— 

Poooo = Poioi = -Pi oio — -Pun = 

Poooi = -Poioo = -Pion = Piuo - § (\xa\ 3 + |y&| 2 ) (10a) 

-Pooio = -Pom = -Piooo = -Pnoi = 

Pooh = Pmo = Piooi = Piioo = £ (\xb\ 2 + |ya| 2 ) (10b) 

In particular, the probabilities Pioio, Pini, Pion, an d 
Pluo are all the same in this case and given by 

Pioio = Pirn = Pion = Pmo = g (\xa\ 2 + hM 2 ^ 
= I (cos 2 9 a cos 2 9 b + sin 2 9 a sin 2 9 b ) 

(11) 

The entangle-measure attack can thus be detected us- 
ing the same method employed to detect the intercept- 



where Pijki is the exact theoretical probability given, 
for example, for a qubit system by the absolute square 
of Vijki given by Eqs. (5). Thus, the experimen- 
tally determined probabilities P^f = N^^/N are ac- 
curate to - ^ 2NP w£-K jMl < _i= , Taking N = 10", 

Pijkl s are accurate to ^ decimal points. The real values 
cos# a ,cos</> Q ,cos#6, and cos cj>b that are determined from 
these experimentally determined probabilities should also 
be accurate to D = 5 decimal points. We conclude 
therefore that, for Alice and Bob to securely share 4D 
digits, they should perform ~ 10 2D Bell-state measure- 
ments each. The proposed scheme has therefore a rather 
low efficiency of - 4£>1CT 215 . 

The efficiency of the scheme can be enhanced by not- 
ing that the efficiency decreases exponentially with D. 
Instead of trying to obtain 4D digits in a single experi- 
ment consisting of ~ 10 2D measurements, Alice and Bob 
can opt to divide it into many independent experiments 
each with different values of parameters a, 6, x and y. 
For example, consider the situation where Alice and Bob 
want to share 400 digits. They can achieve it by per- 
forming ~ 10 200 Bell-state measurements in a single ex- 
periment and obtaining 4 real numbers accurate to 100 
decimal points, i.e., 400 digits. Alternatively, they can 
choose to shoot for only four digits in a single experi- 
ment by performing ~ 10 2 Bell-state measurements and 
obtaining 4 real numbers accurate only to one decimal 
point. They can then repeat the experiment 100 times, 
each time with different values of a, b, x and y to obtain 
400 real numbers each accurate to one decimal point, i.e., 
400 digits. Using this "divide-repeat" strategy, the num- 



resend attack. If Eve entangles every qubit B with her 
ancilla qubit E, it can be detected by checking if Pioio 
or Pini is the same as (or close to) Pion or Pmo- In 
general, however, Alice and Bob should perform digit 
comparison to detect the attack, because Eve can attack 
only a part of the qubits B. 

Let us turn our attention to practical issues con- 
cerning the proposed scheme. Suppose Alice and Bob 
want to securely share 4 real numbers less than 1 
(cos# a , cos0 a , cos^b, cos 0b) each accurate to D decimal 
points, or equivalently 4 integers each of length D, or 
equivalently 4D digits. How many times do Alice and 
Bob each need to perform Bell-state measurements? 
When a sufficiently large number N^>1 of Bell-state mea- 
surements are made, the number AH^y of times the joint 
outcome \§ij) a A\®ki}(3B is counted lies within the range 
defined as la 



(12) 



ber of Bell-state measurements performed by Alice and 
Bob is reduced to ~ 10 4 and the efficiency is enhanced 
to — 400/ 10 4 = 4 x 10~ 2 . Even if some (two or three) 
of these four digits obtained from each single experiment 
need to be used for checking against eavesdropping at- 
tacks, the efficiency still remains to be ~ 10~ 2 . If Alice 
and Bob feel that they need more digits than two or three 
from each single experiment to be used for the security 
check, they can make ~ 10 4 Bell-state measurements and 
obtain eight digits in a single experiment. They can then 
repeat the experiment 50 times to obtain 400 digits al- 
together. The efficiency in this case is ~ 1.6 x 10~ 5 . 
Another way of increasing the efficiency is to use high- 
dimensional systems. Since the number of real numbers 
that can be shared increases with increased dimension, 
the efficiency also increases by going to high-dimensional 
systems. 

Up to now we have assumed an ideal situation where 
there are no losses and no errors. In general, however, 
losses and errors are unavoidable and their effects must 
be taken into account. Due to losses, only Nr) qubits 
out of N qubits sent from Alice will be detected by Bob, 
where rj is the probability that a single photon sent form 
Alice is detected at Bob's detectors. If one considers only 
the channel losses, it is given by rj = 10~( Q ' +C )/ 10 , where 
a is the absorption coefficient, I is the length of the chan- 
nel(fiber) and c accounts for a distance-independent loss 
in the channel. The probabilities P^'s should then be 
determined by comparing the number N^^s not to N 
but to Nrj. A more accurate determination of the prob- 
abilities can be obtained if one lets Bob announce his 
measurement result every time he receives a qubit B. He 
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should announce whether the outcome of his Bell-state 
measurement is $10 or $n or inconclusive (correspond- 
ing to the case where the outcome is either $ o or <& i 
but he cannot distinguish between the two). The num- 
ber iV,^y can then simply be normalized to the number 
of times Bob has made his announcement. 

Errors can occur during generation, transmission and 
detection of qubits and can seriously limit the perfor- 
mance of our proposed scheme. Under ideal errorless con- 
ditions, the number of digits that Alice and Bob share can 
be increased simply by increasing the number of qubits 
they prepare and the number of measurements they per- 
form. When errors are present, however, the error rate 
limits the number of meaningful digits that Alice and 
Bob share through a single experiment, and it may be 
meaningless to increase the number of measurements to 
be made in a single experiment beyond a certain level. 
For example, suppose the error rate is 5%. The accu- 
racy of the probabilities P^'s determined from the ex- 
periment cannot be better than 5%, which means that 
even the digit at the second decimal point of the real 
numbers cos 6 a , cos <p a , cos 6b and cos fa determined from 
these probabilities is not guaranteed to be accurate. It 
is then best for Alice and Bob to shoot for four digits, 
one digit for each real number, in a single experiment. 
The number of measurements that can guarantee the ac- 
curacy of the digit at the first decimal point is <~ 10 2 
and it is in this case meaningless to increase the number 
of measurements well beyond <~ 10 2 in one experiment. 
When more digits are desired to be shared, Alice and 
Bob need to repeat the process of ~ 10 2 measurements 
with different sets of parameters a, b, x and y. Thus, the 
"divide-repeat" strategy is not only desirable to enhance 
the efficiency but also required to make the scheme work 
in the presence of errors. 

We are now in a position to propose a protocol for 
quantum number distribution which allows two parties, 
Alice and Bob, to share securely a certain number of 
digits. Alice and Bob should proceed as follows. 

(1) Alice prepares N entangled pairs AB, each in state 
\&oo) ab, keeps the qubit A and sends the qubit 
B to Bob. Alice has another set of Nr] qubits a 
and divides them into ./V77/IOO groups with each 
group consisting of 100 qubits. (We assume for 
simplicity that Nr] is an integral multiple of 100.) 
She prepares the qubits in the jth group (j=l, 2, 

JV77/IOO) in state (aj|0) Q + bj\l) a ). Bob has a 
set of Nr] qubits (3 and divides them into A^/100 
groups with each group consisting of 100 qubits. 
He prepares the qubits in the jth group in state 
(x 3 \Q)p + y \l) p ). 

(2) Bob takes the first 100 qubits B he receives and the 
100 qubits in the first group of the qubits [3. He per- 
forms a Bell-state measurement on each qubit pair 
(3B and announces publicly where the outcome of 
each measurement is $10 or <j>n or inconclusive. 
Alice takes the 100 qubits A, entangled partners of 



the first 100 qubits B that Bob received, and the 
100 qubits in the first group of qubits a. She per- 
forms a Bell-state measurement on each qubit pair 
aA and announces publicly whether the outcome 
of each measurement is $10 or $n. 

(3) Alice and Bob count the numbers N^ 07 
^im> ^1011 > an d JVmo °f .i omt occurrences of 

|$10)aA|$K))/3B, |$ll)aA|$ll)/3B, \®w)aA\$ll)l3B, 

and | < 3?ii) q: a| < &io)/3S, and determine the corre- 
sponding probabilities P^i = ^tjki/^^- F rom t ne 
probabilities, they determine cos6 a , cos<f) a , cosOb 
and cos<f>b, each to the first decimal point. They 
now share 4 digits. 

(4) As a check for the accuracy of the experiment, Al- 
ice and Bob check if Piq[ and P^xii agree at least 
to the first decimal point. If not, they discard the 
data and restart. They do the same checking for 
P^x\ an d P\iw- As a check against eavesdropping 
attacks, they check if Pfoio ( or ^mi) 1S sufficiently 
different from Piqu ( or Pino)- ^ n °t> they discard 
the data and restart. 

As a further check against eavesdropping attacks, 
Alice and Bob each take two of the four digits they 
share ( they could take one or three digits depend- 
ing upon the level of confidence) and publicly com- 
pare and check if each of the two pairs agree. If 
the agreement is found, then they each keep the re- 
maining two digits as the key. If not, they discard 
the data and restart. 

(5) The steps (2)-(4) are repeated ^ times, each time 
with a different set of 100 qubits each of A, B, a and 
(3. When all measurements are completed success- 
fully, Alice and Bob have collected between them 
2 x real numbers each accurate to the first dec- 
imal point, i.e., 2 x ^ digits. The 2 x digits 
constitute the final key. 

We note that if the error rate is below 1%, Alice and 
Bob can shoot for 8 digits instead of 4 digits in a single ex- 
periment, by dividing the qubits into groups of 10 4 qubits 
instead of 100 qubits, and performing ~ 10 4 Bell-state 
measurements instead of 100 measurements in a single 
experiment. Each single experiment will then produce 4 
real numbers accurate to the second decimal point, i.e., 
eight digits. This way Alice and Bob have more qubits 
available for digit comparison, but the efficiency will be 
lower. 

In conclusion we have proposed a protocol based on en- 
tanglement and Bell-state measurements that allows two 
parties to exchange real numbers securely. As compared 
with the standard quantum cryptographic protocols such 
as BB84, our proposed protocol suffers from the low ef- 
ficiency. With the help of the "divide-repeat" strategy, 
however, its efficiency can be increased to ~ 10~ 2 . As 
the security of the proposed protocol relies upon the fact 
that an act of eavesdropping changes the outcome of the 
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Bell-state measurements, the protocol requires the pro- 
cess of digit comparison to protect against eavesdropping 
attacks. The protocol, however, does not require random 
choice between two conjugate bases as in BB84 nor the 
Bell's inequality test as in E91. The proposed proto- 
col appears to protect itself well against eavesdropping 
attacks. It is secure, in particular, against an individ- 
ual attack in which Eve attacks every qubit transmitted 
from Alice to Bob, because such an all-out attack leaves 
its mark on the probabilities. If Eve attacks only a part 
of the qubits, then Alice and Bob have to perform infor- 
mation reconciliation, which consists of checking if some 
randomly selected digits they share agree. Ironically, the 
low efficiency of the protocol works to help this digit com- 
parison process effective. Because of the low efficiency, 
the information on whether there were eavesdropping at- 
tacks is contained in a relatively small number of digits 
produced by the protocol. The agreement between just 
a small number of pairs of digits can thus be considered 
as a strong indication for the absence of eavesdropping 
attacks. 



We note that our proposed protocol provides a way of 
two-way communication, allowing simultaneous mutual 
exchange of information between Alice and Bob. Alice 
and Bob are simultaneously both the sender and the re- 
ceiver of information, while in standard cryptographic 
protocols information usually flows one way. 

On the practical side, a successful operation of the pro- 
posed protocol requires generation, distribution, and de- 
tection of entanglement at a single-photon level, a diffi- 
cult but not an impossible task. It requires, in partic- 
ular, a large number of Bell-state measurements to be 
performed. We emphasize, however, that only two of the 
four Bell states are required to be distinguished. The 
distinction of the two Bell states is possible using only 
linear optical means and therefore can be accomplished 
without too much difficulty with the present technology. 

Channel errors must be minimized for a successful op- 
eration of the protocol. If our protocol is to work at all, 
the error rate must be kept below ~ 10%, because the 
error rate of over ~ 10% will not guarantee the accuracy 
of the digit even at the first decimal point. 
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